Atty. Dkt. No. 043034-0164 

Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1 . (Currently Amended) A system comprising: 

a participant subsystem that is authorized to anonymously participate in a plurality of 
sessions using secret information provided by a manager subsystem, all of said secret 
information being transmitted to the participant subsystem prior to participation in a first of 
said plurality of sessions, said secret information enabling participation in each of the 
plurality of sessions; and 

a reception subsystem that d e t e rmines wh e th e r it is acceptabl e for th e participant 
subsyst e m to participat e in a s e ssion, ; 

wherein the participant subsystem comprises: 

an anonymous signing section for authorizin g particular individual data using 
the secret information depending on session-related information to produce anonymous 
participation data with an anonymous signature^-and; 

wherein the reception subsystem comprises: 

an anonymous signature determining section for determining whether received 
data is said anonymous participation data with said anonymous signature authorized by the 
participant s ubsyst e m ; and 

a sender match determining section for determining whether anonymous 
signatures of two arbitrary different pieces of anonymous participation data representing two 
different contents of individual data that are received in a same session of said plurality of 
sessions are signed by an identical participant subsystemr^md 

wherein participation b v said participant subsystem in a plu rality of different s essions 
is concealed from said recepti on subsystem. 

2. (Original) The system according to claim 1, wherein the anonymous signature includes 
data that is generated by a predetermined expression using the session-related information and 
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the secret information, wherein the sender match determining section checks the data 
included in the anonymous signature of received anonymous participation data. 

3. (Original) The system according to claim 2, wherein the predetermined expression is 
represented by raising a session-dependent base to a power that is dependent on the secret 
information. 

4. (Currently Amended) The system according to claim 1, wherein the anonymous signing 
section authorizes the particular individual data based on a group signature scheme. 

5. (Currently Amended) The system according to claim 1, wherein the anonymous signing 
section authorizes the particular individual data based on an escrowed identity scheme. 

6. (Currently Amended) The system according to claim 1, wherein the anonymous signing 
section comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; 

a group signing section for signing the particular individual data using the session- 
dependent generator and the secret information to produce Jhg anonymous participation data, 
wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating a relationship 
among the session-dependent generator and a generator determined by the particular 
individual data and/or the session-related information. 

7. (Original) The system according to claim 6, wherein the secret information is represented 
by (jc, y 9 v) that satisfies: v = (y + S) 1/e mod n, where y = a x mod w, n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order n, a is an integer mutually prime to n, e is an integer mutually prime to the Euler 
number of n 9 and 5 is a constant other than 1, 
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the generator creating section creates a session-dependent generator g A corresponding 
to a session A and a generator g m is generated based on the individual data m and/or the 
session^, 

the group signing section sets z = g/ and generates a first proof statement 
V\ = SKLOGLOG(z,^,a)[a:z =£> a )](l) 
proving the knowledge of a satisfying z = g A ( a<X )> and a second proof statement 
V 2 = SKROOTLOG(z*^ 5 3 ^ ? e)[p: z*g/ = ^(P")](1) 

proving the knowledge of P satisfying z*g A — gA^ \ 

the linkage data generating section sets z\ = g m y , and generates a third proof statement 

V 3 = SKREP^/z, g m /g A )[y: z x lz =(gJg A ) y ](l) 
proving the knowledge of z\ and z have the same power to the bases g m and g Ay respectively, 

wherein the anonymous participation data is defined as (A 9 m, z, z\, V\ 9 V2, F3). 

8. (Currently Amended) The system according to claim 7, wherein 

the anonymous signature determining section checks V\ 9 V2, and V3 of the anonymous 
participation data to determine whether the received data is the anonymous participation data 
with the anonymous signature authoriz e d by th e participant s ub s yst e m , and 

the sender match determining section checks z of the anonymous participation data to 
determine whethe r the anonymous signatures o f arbitrar y the two different pieces of 
anonymous participation dat a representing th e two different co ntents of individual data that 
are received in the same session of said plurality of sessions are signed by-an _the identical 
participant subsystem. 

9. (Currently Amended) The system according to claim 1 5 wherein the anonymous signing 
section comprises: 

a generator creating section for creating a generator depending on the session-related 
information; 

a group signing section for signing the particular individual data using the generator 
and the secret information to produce Jjjg anonymous participation data, wherein the 
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anonymous participation data includes data obtained by raising the session-dependent 
generator to a power determined by the secret information. 

10. (Previously Presented) The system according to claim 9, wherein the secret information 
is represented by (x,y, v) that satisfies: v = (y + 6) 1/e mod w, where y = a x mod n, the 
individual data is denoted by m 5 n is a product of two prime numbers as used in the RSA 
cryptography, g is a generator that generates a cyclic group of order n, a is an integer mutually 
prime to n, e is an integer mutually prime to the Euler number of n, and 8 is a constant other 
than 1, 

the generator creating section creates a session-dependent generator g A corresponding 
to a session^, 

the group signing section sets z = g/ and generates a first proof statement 

V\ = SKLOGLOG(z 3 ^,a)[a:z = g A (a a )](m) 

proving the knowledge of a satisfying z = gA^ 1 ^ 9 and a second proof statement 

V 2 = SKROOTLOG(z*^ 6 ? ^ s 6)[p: z*g A * = g A ^](m) 

proving the knowledge of p satisfying z*g/ = gA^X 

wherein the anonymous participation data is designated as (A, m, z, V\ 9 V-i). 

11. (Currently Amended) The system according to claim 10, wherein 

the anonymous signature determining section checks V\ , and V2 of the anonymous 
participation data to determine whethe r the received data is the anonymous participation data 
with the anonymous signature authoriz e d by th e participant subsyst e m , and 

the sender match determining section checks z of the anonymous participation data to 
determine whethe r the anonymous signatures o f arbitrar y the two different pieces of 
anonymous participation dat a representing the two different contents of individual data that 
are received in the same session of said plurality of sessions are signed by-a n the identical 
participant subsystem. 
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12. (Currently Amended) The system according to claim 1, wherein the anonymous signing 
section comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; 

an escrow identifying section for signing the particular individual data using the 
session-dependent generator and the secret information to produce _the anonymous 
participation data, wherein the anonymous participation data includes data obtained by raising 
the session-dependent generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating a relationship 
among the session-dependent generator and a generator determined by the individual data 
and/or the session-related information. 

13. (Original) The system according to claim 12, wherein the secret information is 
represented by (a, b) that satisfies b = (a e - 5) 1/e mod n, where n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order «, a is an integer mutually prime to «, e is an integer mutually prime to the Euler 
number of and 8 is a constant other than 1 , 

the generator creating section creates a session-dependent generator g A corresponding 
to a session A and a generator g m is generated based on the individual data m and/or the 
session A, 

the escrow identifying section sets z a = gA^ a ^ and generates a first proof statement 

V\ = SKROOTLOG(z„,^,e)[a: z a = g A ^]{\) 
proving the knowledge of a satisfying z a = gA^X and sets z^ = gJJ^} and generates a second 
proof statement 

V 2 = SKROOTLOG(z^,^)[p: z b = g A (b e )](l) 

proving the knowledge of P satisfying z^ = g A (b ), and 

the linkage data generating section sets z c = g m ^ a ^ and generates a third proof 
statement 

F 3 - SKREP(z c /z„, gJg A )[y: z c /z a = (gJg A ) y }(\) 

-6- 

LACA_71 2858.1 



Atty. Dkt No. 043034-0164 



proving the knowledge of z a and z c having the same power to the bases g A and g m , 
respectively, 

wherein the anonymous participation data is defined as (A, V u V 2 , V 3 ). 

14. (Currently Amended) The system according to claim 13, wherein 

the anonymous signature determining section determines whether zjzt - g A is 
satisfied and checks V\ 9 V 2 , and V 3 of the anonymous participation data to determine whether 
the received data is the anonymous participation data with the anonymous signature 
authoriz e d by th e participant subsystem , and 

the sender match determining section checks one of z a and z b of the anonymous 
participation data to determine whethe r the anonymous signatures o f arbitrar y _the two 
different pieces of anonymous participation data representing the two different contents of 
individual data that are received in the same session of said plurality of sessions are signed by 
ae the identical participant subsystem. 

15. (Currently Amended) The system according to claim 1, wherein the anonymous signing 
section comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; and 

an escrow identifying section for signing the particular individual data using the 
session-dependent generator and the secret information to produce jhe anonymous 
participation data, wherein the anonymous participation data includes data obtained by raising 
the session-dependent generator to a power determined by the secret information. 

16. (Original) The system according to claim 15, wherein the secret information is 
represented by (a, b) that satisfies b = (a c - 8) 1/e mod where n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order n 9 a is an integer mutually prime to n, e is an integer mutually prime to the Euler 
number of n, and 8 is a constant other than 1, 

the generator creating section creates a session-dependent generator g A corresponding 
to a session^, 
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the escrow identifying section sets z a = g^ a ^ and generates a first proof statement 

V x = SKROOTLOG(z fl ,^,e)[cc: z a = g A (<* e )](m) 
proving the knowledge of a satisfying z a = gA^X and sets z b = g A (& ) and generates a second 
proof statement 

V 2 = SKROOTLOG(z^,e)[p: z b = ^(^)](m) 

proving the knowledge of [3 satisfying z^, = gA^X 

wherein the anonymous participation data is defined as (A, m, z a9 z^, V\ 9 V 2 ). 

17. (Currently Amended) The system according to claim 16, wherein 

the anonymous signature determining section determines whether zjzb = g A is 
satisfied and checks V\ and V 2 of the anonymous participation data to determine whethe r .the 
received data is the anonymous participation data with the anonymous signature authoriz e d 
by the participant subsyst e m , and 

the sender match determining section checks one of z a and z& of the anonymous 
participation data to determine whether the anonymous signatures o f arbitraryJhg two 
different pieces of anonymous participation dat a representing th e two di fferent co ntents of 
individual data that are received in the same session of said plurality of sessions are signed by 
a n the identical participant subsystem. 

18. (Currently Amended) An anonymous participation authority management method for a 
system, the system comprising a participant subsystem that is authorized to anonymously 
participate in a plurality of sessions using secret information^ and a reception subsystem-that 
d e t e rmin e s wh e th e r it is acc e ptabl e for th e participant subsyst e m to participat e in a s e ssion , 
the method comprising the steps of : 

at the participant subsystem, 

a) authorizin g particular individual data using the secret information 
depending on session-related information to produce anonymous participation data with an 
anonymous signature, all of said secret information being transmitted to the participant 
subsystem prior to participation in a first of said plurality of sessions, said secret information 
enabling participation in each of the plurality of sessions; 
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at the reception subsystem, 

b) determining whether received data is said anonymous participation data 
with said anonymous signature authoriz e d by the participant s ubsyst e m ; and 

c) determining whether anonymous signatures of two arbitrar y different pieces 
of anonymous participation dat a representing two different contents of individual data that are 
received in a same session of the plurality of sessions are signed by an identical participant 
subsystem^ 

wherein participation bv said participant subsystem in a plurality of different sessions 
is concealed from said reception subsystem, 

19. (Currently Amended) The method according to claim 18, wherein the anonymous 
signature includes data that is generated by a predetermined expression using the session- 
related information and the secret information, wherein the step (c) is performed by checking 
the data included in the anonymous signature o f the received anonymous participation data. 

20. (Original) The method according to claim 19, wherein the predetermined expression is 
represented by raising a session-dependent base to a power that is dependent on the secret 
information. 

21. (Currently Amended) The method according to claim 18, wherein the step (a) comprises 
the steps of: 

creating a session-dependent generator depending on the session-related information; 

signing the particular individual data using the session-dependent generator and the 
secret information to produce jthe anonymous participation data, wherein the anonymous 
participation data includes data obtained by raising the session-dependent generator to a 
power determined by the secret information; and 

generating linkage data indicating a relationship among the session-dependent 
generator and a generator determined by the particular individual data and/or the session- 
related information. 
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22. (Currently Amended) The method according to claim 18, wherein the step (a) comprises 
the steps of: 

creating a session-dependent generator depending on the session-related information; 

and 

signing the particular individual data using the session-dependent generator and the 
secret information to produce the anonymous participation data, wherein the anonymous 
participation data includes data obtained by raising the session-dependent generator to a 
power determined by the secret information. 
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